Your privacy, in plain words.
SpookSpot helps Australian neighbours organise Halloween. This notice describes the information the website uses.
Your account
Firebase Authentication stores your email and login credentials. SpookSpot stores your display name, chosen suburb, group membership, family nicknames and confirmation that you declared yourself 18 or older. Your date of birth is checked during setup and is not saved in your profile.
What other people can see
A published home’s name, Halloween icon and colour, suburb, approximate map area, treat list, visiting times and Best Home votes are public. Exact street addresses, coordinates and Google Place IDs are not included in public listings. Verified adult accounts can see the exact address during the home’s local opening hours on 31 October. A verified email and declared adult age do not independently verify a person’s identity. Avoid putting addresses, surnames or contact details in public names, descriptions or treat notes. Hosts can hide their listing at any time.
Costume photos stay local
Costume images, captions, display names and total likes are visible only to adult accounts whose chosen account suburb matches the post’s suburb. People can change their account suburb; this is regional discovery, not proof of residency. Posts are not available through a public image URL. Location metadata is removed from uploads, but visible house numbers, school uniforms and landmarks can still identify someone. Check your photo and obtain permission from everyone shown before posting. You can remove your post, block an account’s posts or report a privacy concern. People who see content may still save it.
Public Watch-Lists
When you publish a Watch-List, anyone can see your display name, movie names and watched ticks. It does not show your address, email, family profiles or location. Keep personal details out of movie names. Untick “Make my Watch-List public” and save to remove public access, or remove individual movies. People who already saw the list may retain a copy.
Routes and children
Your saved route includes the starting point you choose. Route directions only work while all included homes are open; server access ends at the earliest closing time. A private companion link lets its holder see that route for up to 12 hours, ending earlier when a home closes. Share it privately and revoke it in My crew. Hiding a home also prevents further access to routes containing it. Family profiles use nicknames and have no independent sign-ins or social feed access. A recipient could retain information they already saw.
Your live position is yours
“Show my position” asks your browser for location permission and displays your chosen icon on your own map. SpookSpot does not upload, store or broadcast those position updates to other users or crew members. You can stop location access with “Hide my position”. If you choose your position as a route start and plan a walk, that chosen starting point is sent to Google for directions and saved in your private route. Google Maps processes map requests for the areas you view.
Services that process data
Firebase and Google Cloud provide authentication, storage and hosting. Google Maps processes location searches and walking-route requests. Stripe handles checkout and payment details. SpookSpot stores payment references and status, not card numbers. Firestore and uploaded photos are stored in Sydney; App Hosting runs in Taiwan, and providers may process data internationally.
Control your information
You can update your profile, hide your home, remove your costume posts, leave groups, revoke companion links and reset your password from the dashboard. Report privacy concerns on the affected listing or costume post so the administrator can review them. Payment references and voting records may need to be retained for reconciliation and fair voting.
Browser storage
Firebase uses browser storage to keep you signed in. Google Maps and Stripe may use their own service storage. SpookSpot does not add advertising or analytics trackers.